CVE-2026-34935: PraisonAI: OS Command Injection in MCPHandler.parse_mcp_command()

Published Apr 1, 2026
·
Updated

Summary

The --mcp CLI argument is passed directly to shlex.split() and forwarded through the call chain to anyio.openprocess() with no validation, allowlist check, or sanitization at any hop, allowing arbitrary OS command execution as the process user.

Details

cli/features/mcp.py:61 (source) -> praisonaiagents/mcp/mcp.py:345 (hop) -> mcp/client/stdio/init.py:253 (sink) python source parts = shlex.split(command)

hop cmd, args, env = self.parsemcpcommand(command, envvars) self.serverparams = StdioServerParameters(command=cmd, args=arguments)

sink process = await anyio.openprocess([command, args])

Fixed in commit 47bff65413beaa3c21bf633c1fae4e684348368c (v4.5.69) by introducing a command allowlist: python ALLOWEDCOMMANDS = {"npx", "uvx", "node", "python"} if cmd not in ALLOWEDCOMMANDS: raise ValueError(f"Disallowed command: {cmd}")

PoC python tested on: praisonai==4.5.48 install: pip install praisonai==4.5.48 run: praisonai --mcp "bash -c 'id > /tmp/pwned'" verify: cat /tmp/pwned expected output: uid=1000(...) gid=1000(...) groups=1000(...)

Impact

Any deployment where the --mcp argument is influenced by untrusted input is exposed to full OS command execution as the process user. No authentication is required.

Other sources

PraisonAI is a multi-agent teams system. From version 4.5.15 to before version 4.5.69, the --mcp CLI argument is passed directly to shlex.split() and forwarded through the call chain to anyio.openprocess() with no validation, allowlist check, or sanitization at any hop, allowing arbitrary OS command execution as the process user. This issue has been patched in version 4.5.69.

MITRE

Affected Software

2 affected componentsFixes available
pip/praisonai>=4.5.15<=4.5.68
4.5.69
Praison PraisonAI>=4.5.15<4.5.69

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade pip/praisonai to a version that resolves this vulnerability.

    Fixed in 4.5.69
  2. Upgrade

    Upgrade praisonai to a version that resolves this vulnerability.

    Fixed in 4.5.69Patch 47bff65413beaa3c21bf633c1fae4e684348368c
  3. Configuration

    Ensure the MCP command allowlist is enforced so that the --mcp CLI argument only allows commands present in ALLOWED_COMMANDS (npx, uvx, node, python); any other cmd should be rejected (e.g., raise ValueError: Disallowed command).

    PraisonAI CLI MCPHandler.parse_mcp_command() / mcp client stdio ALLOWED_COMMANDS = {"npx", "uvx", "node", "python"}

Event History

Apr 1, 2026
Advisory Published
via GitHub·11:20 PM
Data Sourced
via GitHub·11:20 PM
DescriptionSeverityWeaknessAffected Software
Apr 3, 2026
CVE Published
via MITRE·10:48 PM
Data Sourced
via MITRE·10:48 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·11:17 PM
RemedyDescriptionSeverityWeaknessAffected Software

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203